In addition to quantifying privacy loss, differential privacy protects provably against membership inference attacks [1]}, [2]}, in which an adversary can determine if a data point participated in the training of a model. This can pose a privacy threat, for example, if participation in model training could imply a client has a particular disease or other risk factor. Alternatives for privatization in general include secure multi-party computation or homomorphic encryption, though neither protect against membership inference attacks [1]}.
Others have combined local differential privacy and federated learning, notably [4]}, [5]}. While [6]} combined federated model distillation with differential privacy, they only attain robust results on non-iid data when the client and distillation data contains the same classes.
